Forum Discussion
Column Level OneLake Security - Not Working with shortcuts
Hi JonBFabric ,
Column-Level Security (CLS) is currently supported only when data is accessed directly from Fabric Lakehouses.
When the same data is accessed via OneLake shortcuts, CLS does not get enforced.This is a known product limitation, not a configuration issue.
To help prioritize this feature, it would be great if you could raise feedback / a feature request through the Microsoft Fabric feedback channel. Product teams actively track requests there, and it helps drive roadmap decisions. I’d encourage you to submit your detailed feedback and ideas via Microsoft's official feedback channels, such as the Microsoft Fabric Ideas.
Feedback submitted here is often reviewed by the product teams and can lead to meaningful improvement.
Thanks,
prashanth
MS Fabric Support
Hi JonBFabric the problem is with your shortcuts, nothing to do with the Filtered tables in Fabric engines. Only passthrough mode is supported on OneLake shortcuts, i.e OneLake security is not applicable.
Please read this Microsoft doc.
Understanding OneLake Security with Shortcuts | Microsoft Fabric Blog | Microsoft Fabric
Passthrough, as opposed to delegated, mode is what Shortcuts use.
From the link you shared:
"OneLake shortcuts utilize the passthrough auth model. In this model, the shortcut accesses data in the target location by ‘passing’ the user’s identity to the target system. This ensures that any user accessing the shortcut is only able to see whatever they have access to in the target. In this sense, the security from the target ‘flows across’ the shortcut to restrict access in the source lakehouse."
Also from Microsoft documents:
"When a user accesses data from another OneLake location through a shortcut, OneLake uses the identity of the calling user to authorize access to the data. This user must have permissions in the target location to read the data." Unify data sources with OneLake shortcuts - Microsoft Fabric | Microsoft Learn
For avoidance of doubt the data in the tables without CLS is accessible accross the shortcut, based on role access defined in OneLake Security.
The reference to Filtered tables in Fabric engines was in relation to your prior assertion that I was using an unsupported engine, which I am not.
Hi JonBFabric ,
Simply put, the Lakehouse UI’s underlying preview mechanism doesn't support column‑level security over shortcut passthrough.And querying using a notebook? The documentation explicitely says that this is supported